PT-2014-8775

Name of the Vulnerable Software and Affected Versions Nibbleblog versions prior to 4.0.2 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the author name or content parameter to "index.php". Recommendations For versions prior to 4.0.2,...

PT-2014-8780

Name of the Vulnerable Software and Affected Versions Incredible PBX version 11 2.0.6.5.0 Description The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the APPTMIN, APPTHR, APPTDA, APPTMO, APPTYR, or APPTPHONE parameters in the reminders/index.p...

CVE-2014-9001: Improper Control of Generation of Code

reminders/index.php in Incredible PBX 11 2.0.6.5.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the 1 APPTMIN, 2 APPTHR, 3 APPTDA, 4 APPTMO, 5 APPTYR, or 6 APPTPHONE parameters...

PT-2014-8783

Name of the Vulnerable Software and Affected Versions vldPersonals versions prior to 2.7.1 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the id parameter in a "member profile" action to "index.php". Recommendations For versions prior t...

CVE-2014-9005: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in vldPersonals before 2.7.1 allow remote attackers to execute arbitrary SQL commands via the 1 country, 2 gender1, or 3 gender2 parameter in a search action to index.php...

PT-2014-8784

Name of the Vulnerable Software and Affected Versions vldPersonals versions prior to 2.7.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the country, gender1, or gender2 parameter in a search action to "index.php". Recommendations For...

CVE-2014-9004: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in vldPersonals before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter in a memberprofile action to index.php...

CVE-2014-8996: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Nibbleblog before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 authorname or 2 content parameter to index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the Page visualization agents in Pandora FMS 5.1 SP1 and earlier allows remote attackers to inject arbitrary web script or HTML via the refr parameter to index.php...

CVE-2014-8629

Cross-site scripting XSS vulnerability in the Page visualization agents in Pandora FMS 5.1 SP1 and earlier allows remote attackers to inject arbitrary web script or HTML via the refr parameter to index.php...

CVE-2014-8629

CVE-2014-8629 affects Pandora FMS up to version 5.1 SP1, specifically the Page visualization agents. The vulnerability is an XSS flaw in the index.php endpoint where the refr parameter is returned to users without proper validation, enabling remote attackers to inject arbitrary web script or HTML...

PT-2014-8654

Name of the Vulnerable Software and Affected Versions Pandora FMS versions 5.1 SP1 and earlier Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the refr parameter to "index.php". Recommendations For versions 5.1 SP1 and...

CVE-2014-8629: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Page visualization agents in Pandora FMS 5.1 SP1 and earlier allows remote attackers to inject arbitrary web script or HTML via the refr parameter to index.php...

CVE-2014-8954

CVE-2014-8954 affects phpSound up to version 1.0.5. The issue is multiple XSS vulnerabilities exploitable via (1) the Title field, (2) the Description field in playlists, or (3) the filter parameter in an explore action to index.php, enabling remote script/HTML injection. The OpenVAS entry corrob...

PT-2014-2235

Name of the Vulnerable Software and Affected Versions phpMoneyBooks versions prior to 1.0.3 Description The issue allows remote attackers to include and execute arbitrary local files via a .. dot dot in the module parameter of the index.php file. This is a directory traversal vulnerability...

PT-2014-2425

Name of the Vulnerable Software and Affected Versions phpMoneyBooks version 1.0.4 Description A directory traversal issue exists, allowing remote attackers to read arbitrary files by including a .. dot dot in the file parameter of the index.php file. Recommendations For phpMoneyBooks version 1.0....

CVE-2012-1669: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in phpMoneyBooks before 1.0.3 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the module parameter...

CVE-2012-6665: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in phpMoneyBooks 1.0.4 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter, a different vulnerability than CVE-2012-1669. NOTE: the provenance of this information is unknown; the details are obtained solely from thi...

CVE-2014-8954: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in phpSound 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 Title or 2 Description fields in a playlist or the 3 filter parameter in an explore action to index.php...

PT-2014-8757

Name of the Vulnerable Software and Affected Versions phpSound version 1.0.5 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific fields, including the Title or Descriptio...